Security Reporting Policy

Introduction

At Voyager Systems, we are committed to maintaining the security and integrity of our products and services. We recognize the valuable role that security researchers and individuals play in identifying and reporting security vulnerabilities. We appreciate your efforts in helping us keep our systems safe and secure.

Reporting Vulnerabilities

If you discover a potential security vulnerability in any of our products or services, we encourage you to report it to us. We take all reports seriously and will assess them based on their validity, severity, and practical impact. Your responsible disclosure helps us protect our users and strengthen our security.

Submitting a report is voluntary. It does not, by itself, create a consulting agreement, authorize paid work, or guarantee swag, payment, reimbursement, or other recognition.

Known Issues and Duplicate Reports

Voyager Systems maintains an internal record of known vulnerabilities and security issues. If your report duplicates an issue already recorded in our system, we will let you know following our assessment.

A duplicate report may receive no reward. If your report demonstrates additional security impact or provides materially new information, we will consider that information as part of our assessment.

How to Report a Vulnerability

Please send reports to securityreporting@voyagersystems.cloud and include:

• Description of the vulnerability: Identify the affected product or service, explain the issue and its potential impact, and provide the minimum technical detail or steps needed to reproduce it safely.
• Supporting evidence: Include relevant screenshots or a limited proof of concept where necessary. Avoid accessing, collecting, or disclosing personal information, confidential records, or other users' data.
• Your contact information: Include your name and preferred contact details so we can request clarification or provide updates.

An initial report should be sufficient for us to assess the issue. Extensive research, multiple proof-of-concept variants, detailed remediation plans, proposed code changes, or implementation work are not required unless we expressly request and agree to that additional scope.

Before Doing Additional Work

Before investing substantial time in further testing, detailed analysis, additional proof-of-concept development, remediation proposals, or fixes, contact us to discuss the proposed scope and depth of the work.

Do not assume that additional effort will qualify for a reward or increase a potential reward. Work performed voluntarily or without an agreed paid engagement remains unpaid unless Voyager Systems separately approves a discretionary reward.

A discussion about scope, a request for clarification, or an expression of interest does not authorize consulting fees. If you expect payment for your time or services, a consulting agreement must be completed before that work begins.

Our Commitment

Collaboration

When you report a vulnerability to us, you can expect:

• Initial Acknowledgement: We will acknowledge receipt of your report within 5 business days. This timeframe applies only to the initial acknowledgement, not to assessment, resolution, reward decisions, or payment. Those steps may take longer depending on the issue's complexity and the internal teams involved.
• Investigation: Our security team will assess the issue's validity and impact, determine appropriate action, and communicate an anticipated resolution timeline where reasonably possible.
• Communication: We will provide relevant updates as the investigation and any remediation progress.
• Resolution: For verified vulnerabilities requiring remediation, we will work to develop and implement an appropriate resolution.

Acknowledging, reviewing, reproducing, or addressing a report does not constitute acceptance of consulting services, an invoice, or a payment obligation.

Legal Protection

Voyager Systems will not take legal action against you for reporting a potential security vulnerability in good faith. Receiving or acknowledging a report does not authorize the testing that produced it or any further testing.

For research conducted within a testing scope expressly authorized by Voyager Systems in writing, we will not pursue legal action against you for that research, provided you:

• Stay within the authorized systems, activities, and testing limits.
• Follow the Testing Boundaries below and make a reasonable effort to avoid privacy violations, destruction of data, and interruption or degradation of our services.
• Report findings promptly and do not disclose the vulnerability or related information to the public or third parties without our consent.
• Comply with all applicable laws and regulations.

This commitment applies to Voyager Systems only. We cannot authorize research on behalf of third parties or make commitments about actions they may take.

Discretionary Recognition and Rewards

To express our gratitude for responsible disclosure, Voyager Systems may, at its sole discretion, offer swag, a monetary reward, or other recognition for significant security vulnerabilities. Rewards are assessed on a case-by-case basis and are not guaranteed.

Not every report will receive a reward. A valid report, a minor vulnerability, multiple findings, or the inclusion of proof-of-concept code or suggested fixes does not automatically qualify for swag or monetary compensation.

We consider factors such as severity, demonstrated impact, originality, whether the issue is already known, and the usefulness of the report. The number of reports submitted, hours spent, or amount of supporting material provided does not establish a payment entitlement or determine a reward amount.

Any monetary reward must be expressly approved and confirmed in writing by Voyager Systems, including the amount, currency, and any applicable payment conditions. A discretionary reward is recognition for a report; it is not payment for consulting hours or an agreement to purchase additional services.

Duplicate, Related, and Informational Findings

Duplicate reports, previously known issues, automated scanner output without validation, and general hardening recommendations without demonstrated security impact may receive no reward.

Multiple reports arising from the same underlying vulnerability, or resolved by the same corrective action, may be assessed together as a single finding for reward purposes. Different URLs, endpoints, or proof-of-concept variations do not automatically qualify as separate vulnerabilities or separate rewards.

No Consulting Agreement or Authorization for Paid Work

Submitting a vulnerability report, proof of concept, proposed fix, remediation advice, or other material does not create a consulting, contractor, employment, or other paid-services relationship with Voyager Systems.

A consulting engagement exists only when a written contract setting out the scope of work and compensation has been delivered through DocuSign and fully executed by the researcher and two authorized representatives of Voyager Systems.

Until that contract is fully executed, do not begin work for which you expect consulting fees or expense reimbursement.

Routine correspondence, acknowledgements, technical discussions, requests for clarification, or requests for additional report information do not substitute for that contract. Silence or continued communication does not constitute approval of fees.

Unsolicited invoices, fee schedules, time records, or payment demands do not establish a payment obligation for voluntary reporting or work that was not authorized under a fully executed consulting contract.

Retesting and Follow-Up Work

Retesting, additional investigation, and remediation work require agreement on scope before they begin. Requests to clarify or reproduce an existing report do not authorize consulting fees or guarantee an additional reward. Any paid services remain subject to the consulting-contract requirements in this policy.

Reward Payments

We recognize that valuable security reports can come from individuals anywhere in the world, and we greatly appreciate the time, skill, and effort contributed by our global research community. We understand that financial restrictions can create difficulties for researchers in certain countries and regions, and we aim to accommodate lawful payment arrangements wherever possible.

Approved monetary rewards will be paid through Interac e-Transfer within Canada, or through PayPal or Wise where available and permitted. Direct wire transfers are not available. Researchers are responsible for providing accurate payment details and selecting a supported method through which they can lawfully receive payment.

If you are located in a country or region affected by Canadian or U.S. sanctions, we remain committed to paying approved rewards where payment is legally permitted. Please provide a proposed payment arrangement using one of the supported methods and a lawful, non-sanctioned payment route for our review. The arrangement must comply with all applicable sanctions, laws, and payment-provider requirements, including those concerning the actual recipient and any intermediaries. An alternative payment route cannot be used to circumvent restrictions that apply to the recipient or transaction.

To the extent permitted by law, Voyager Systems is not responsible for funds frozen, blocked, or seized in transit by financial institutions, payment providers, or government authorities for reasons outside our control, provided we have correctly followed the agreed payment instructions.

Scope

This policy provides a reporting channel for potential vulnerabilities affecting Voyager Systems products and services. It does not provide blanket authorization to test or scan our systems.

Before actively researching or testing our systems, contact securityreporting@voyagersystems.cloud to obtain written agreement on the permitted systems, activities, and testing limits.

Customer environments, third-party services, and supplier infrastructure are outside the permitted testing scope unless expressly included in written authorization from the party authorized to approve that testing. Voyager Systems cannot authorize testing of systems it does not control.

If you discover a vulnerability unexpectedly, report it as soon as possible and obtain authorization before conducting further testing.

Unauthorized testing or scanning may violate our terms of service and may result in legal action, particularly where it causes service degradation, privacy violations, or other harm.

Authorization to conduct testing does not authorize paid work or guarantee a reward.

Testing Boundaries

Do not perform denial-of-service testing, social engineering, credential attacks, install persistent access, modify or delete data, or move into other systems unless we have expressly authorized that specific activity in writing.

If you encounter personal information, confidential records, credentials, or other sensitive data, stop testing immediately and notify us. Do not continue accessing records to demonstrate the extent of the issue. Provide only the minimum evidence necessary to describe it safely, and contact us for secure submission instructions where needed.

Contact Us

If you have questions about this policy, permitted testing, reporting expectations, potential rewards, or a proposed consulting engagement, contact securityreporting@voyagersystems.cloud before undertaking substantial additional work.

Thank you for helping us keep Voyager Systems, our customers, and our employees safe and secure.

Last Updated: October 8, 2026